ClawHub
Back to skill

Security audit

AI KEY·发布前审一遍

Security checks for vulnerabilities and agentic risk

Overview

This script reviewer automatically saves feedback for future reviews without clearly limiting what is retained or requiring a retention choice.

Before sharing confidential scripts or business details, require session-only reviews or approve each saved note and its destination. Inspect the missing shared rules and writeback policy before enabling vault memory; their exact retention behavior could not be verified.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

The diagnose-only script reviewer also automatically persists user feedback to a local vault.

Medium
Category
Excessive Agency
Confidence
93% confidence
Finding

The skill explicitly directs automatic persistence of user feedback and later instructs writing review memories, introducing durable filesystem changes beyond the advertised script-review task. Although 'diagnose-only' primarily limits rewriting rather than all file operations, users have not clearly authorized retention of potentially confidential feedback; local storage limits exposure compared with external transmission, but subsequent reviews may reuse the retained material.

Content

No source excerpt is available for this finding.

User feedback is automatically persisted without a user-facing warning.

Medium
Category
Output Handling
Confidence
95% confidence
Finding

The instruction to automatically save any user feedback does not require a user-facing notice or consent, and the skill later reloads stored memories for future reviews. Feedback could contain private script excerpts or business details, creating undisclosed retention and cross-session reuse; this overlaps with the first finding rather than establishing a separate exfiltration mechanism.

Content

No source excerpt is available for this finding.